M3U8 Media Downloader

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:06 AM UTC
• Version: 1.0.3

Overview

This skill appears to be a disclosed media-downloader wrapper, with the main risk being normal trust in a pinned third-party npm CLI and ffmpeg.

Install this only if you are comfortable trusting the pinned @lzwme/m3u8-dl npm package and your ffmpeg installation. Use it in a sandbox or limited download directory, avoid exposing the optional WebUI without a strong secret, and make sure any media downloads comply with site terms and local law.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unverified Third-Party Package Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-22
Vulnerability Type: Third-party dependency and software supply-chain risk
Risk Level: Medium

Vulnerable Code Snippet:

json

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "formula": "@lzwme/m3u8-dl@1.9.0",
      "bins": ["m3u8dl"],
      "label": "Install m3u8-downloader CLI (node)",
    },
  ],

Technical Analysis

The skill directs the host environment to install and subsequently execute the external npm package @lzwme/m3u8-dl@1.9.0. Pinning the package version reduces exposure to unexpected future upgrades, but it does not independently verify that the pinned release, its transitive dependencies, or its installation scripts are trustworthy.

The audited project contains no vendored dependency source, package lockfile, cryptographic checksum, or other integrity record through which the package implementation could be verified. The external npm package and linked repository were not included in the supplied artifact, so their executable code could not be inspected during this audit.

This creates a software supply-chain trust boundary: installation or execution may run code that is not represented by the reviewed SKILL.md file.

Attack Path

1. An attacker compromises the referenced npm package release, its maintainer account, its distribution channel, or a transitive dependency.
2. The skill installation mechanism retrieves @lzwme/m3u8-dl@1.9.0 and its dependencies from the external package registry.
3. Malicious code executes through an npm lifecycle script or when the installed m3u8dl binary is invoked.
4. The code operates with the permissions granted to the agent or installation process and can access resources available within that execution environment.

This path is conditional on compromise or malicious content in the external dependency; the supplied artifact itself does not ...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor and review the exact dependency source, including all transitive dependencies and npm lifecycle scripts, before deployment.
2. Add a lockfile with integrity hashes and enforce immutable, reproducible dependency installation.
3. Verify package provenance, publisher identity, release signatures, and registry integrity before installation.
4. Disable npm lifecycle scripts where they are unnecessary, such as by using npm install --ignore-scripts, after confirming that this does not break required functionality.
5. Run installation and media-processing operations in an isolated sandbox with minimal filesystem permissions, no unnecessary credentials, and tightly restricted outbound network access.
6. Use a trusted internal package mirror or an approved artifact repository after independently scanning and pinning the package artifact.
7. Generate and monitor a software bill of materials, and continuously scan the pinned package and its transitive dependency graph for known vulnerabilities or unexpected changes.
8. Execute ffmpeg and the downloaded CLI under a dedicated, unprivileged account with access limited to designated input, output, and temporary directories.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger description is broad enough to match many generic download or media-link requests, which can cause the skill to activate in situations beyond narrow user intent. In this context, that increases the chance of invoking network-capable tooling for arbitrary URLs and download tasks, including copyrighted, unsafe, or policy-sensitive content, without sufficient scoping or user confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The description emphasizes Chinese platforms and Chinese trigger phrases such as 抖音/皮皮虾/微博视频 and 获取视频信息、解析视频链接, but it does not clarify whether this is optional or region-specific. This can be read as a locale-specific activation policy without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.